CVE-2024-5791: 
WordPress vulnerability analysis and mitigation

The Online Booking & Scheduling Calendar for WordPress by vcita plugin is affected by a Stored Cross-Site Scripting vulnerability (CVE-2024-5791) discovered in versions up to and including 4.4.2. The vulnerability exists due to missing authorization checks in the processAction function and insufficient input sanitization and output escaping (NVD).

The vulnerability is classified as a Cross-Site Scripting (CWE-79) issue with a CVSS v3.1 base score of 6.1 (Medium) according to NVD, and 7.2 (High) according to Wordfence. The attack vector is network-based (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N). The vulnerability specifically affects the 'wp_id' parameter and allows unauthenticated attackers to inject malicious web scripts (NVD).

When successfully exploited, this vulnerability allows unauthenticated attackers to inject arbitrary web scripts that execute whenever a user accesses the wp-admin dashboard. This can lead to potential compromise of user sessions and unauthorized actions performed in the context of the authenticated administrator (NVD).

Users should upgrade to a version newer than 4.4.2 of the Online Booking & Scheduling Calendar for WordPress by vcita plugin to address this vulnerability (NVD).